Procedure examples

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.

BlackByte enumerated installed security products during operations.

SideCopy uses a loader DLL file to collect AV product names from an infected host.

Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct. Kimsuky has also obtained details on antivirus software through WMI queries using `Win32_OperatingSystem` and `SecurityCenter2.AntiVirusProduct`. Kimsuky has also checked the status of Windows Defender through the use `cmd /s sc query WinDefend`.

Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.

Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.

Gamaredon Group has used PowerShell scripts to identify security software on the victim machine.

TeamTNT has searched for security products on infected machines.

Sidewinder has used the Windows service winmgmts:\\.\root\SecurityCenter2 to check installed antivirus products.

Rocke used scripts which detected and uninstalled antivirus software.

TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.

Tropic Trooper can search for anti-virus software running on the system.

Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.

The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.

Storm-0501 has detected endpoint security solutions using `sc query sense` and `sc query windefend`.

Medusa Group has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.

Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.

Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.

ToddyCat can determine is Kaspersky software is running on an endpoint by running `cmd /c wmic process where name="avp.exe"`.

Malteiro collects the installed antivirus on the victim machine.

APT42 has used Windows Management Instrumentation (WMI) to check for anti-virus products.

Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.

Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.

Play has used the information-stealing tool Grixba to scan for anti-virus software.

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.